Analysis
-
max time kernel
77s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe
-
Size
949KB
-
MD5
46c0d30b6ffda79225695aba2c8df5b2
-
SHA1
e2b1cbdb926bbb29e92c27c462e3890993065508
-
SHA256
214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593
-
SHA512
6a9e09ba5c7263172a2f22ac2a6d0a45402d33b4e14e61a3c2c5c3ce6a054a564b5957bab1cccb97b745a6ffb7635f82b2c7804686ce22efb8997da0b9c84ff0
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4448 4596 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4796 schtasks.exe 2204 schtasks.exe 3568 schtasks.exe 2376 schtasks.exe 4604 schtasks.exe 5108 schtasks.exe 4372 schtasks.exe 4468 schtasks.exe 5068 schtasks.exe 4084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4824 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 82 PID 4596 wrote to memory of 4824 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 82 PID 4596 wrote to memory of 4824 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 82 PID 4596 wrote to memory of 3408 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 83 PID 4596 wrote to memory of 3408 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 83 PID 4596 wrote to memory of 3408 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 83 PID 4596 wrote to memory of 5024 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 95 PID 4596 wrote to memory of 5024 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 95 PID 4596 wrote to memory of 5024 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 95 PID 4596 wrote to memory of 1080 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 85 PID 4596 wrote to memory of 1080 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 85 PID 4596 wrote to memory of 1080 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 85 PID 4596 wrote to memory of 3496 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 86 PID 4596 wrote to memory of 3496 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 86 PID 4596 wrote to memory of 3496 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 86 PID 4596 wrote to memory of 452 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 91 PID 4596 wrote to memory of 452 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 91 PID 4596 wrote to memory of 452 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 91 PID 4596 wrote to memory of 3888 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 90 PID 4596 wrote to memory of 3888 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 90 PID 4596 wrote to memory of 3888 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 90 PID 4596 wrote to memory of 216 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 92 PID 4596 wrote to memory of 216 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 92 PID 4596 wrote to memory of 216 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 92 PID 4596 wrote to memory of 2552 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 98 PID 4596 wrote to memory of 2552 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 98 PID 4596 wrote to memory of 2552 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 98 PID 4596 wrote to memory of 3600 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 97 PID 4596 wrote to memory of 3600 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 97 PID 4596 wrote to memory of 3600 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 97 PID 4596 wrote to memory of 2256 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 105 PID 4596 wrote to memory of 2256 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 105 PID 4596 wrote to memory of 2256 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 105 PID 4596 wrote to memory of 680 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 103 PID 4596 wrote to memory of 680 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 103 PID 4596 wrote to memory of 680 4596 214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe 103 PID 2552 wrote to memory of 4372 2552 cmd.exe 106 PID 4824 wrote to memory of 3568 4824 cmd.exe 111 PID 2552 wrote to memory of 4372 2552 cmd.exe 106 PID 4824 wrote to memory of 3568 4824 cmd.exe 111 PID 2552 wrote to memory of 4372 2552 cmd.exe 106 PID 4824 wrote to memory of 3568 4824 cmd.exe 111 PID 3600 wrote to memory of 4084 3600 cmd.exe 107 PID 3600 wrote to memory of 4084 3600 cmd.exe 107 PID 3600 wrote to memory of 4084 3600 cmd.exe 107 PID 452 wrote to memory of 2204 452 cmd.exe 110 PID 452 wrote to memory of 2204 452 cmd.exe 110 PID 452 wrote to memory of 2204 452 cmd.exe 110 PID 3496 wrote to memory of 4796 3496 cmd.exe 108 PID 3496 wrote to memory of 4796 3496 cmd.exe 108 PID 3496 wrote to memory of 4796 3496 cmd.exe 108 PID 3408 wrote to memory of 4468 3408 cmd.exe 109 PID 3408 wrote to memory of 4468 3408 cmd.exe 109 PID 3408 wrote to memory of 4468 3408 cmd.exe 109 PID 216 wrote to memory of 2376 216 cmd.exe 112 PID 216 wrote to memory of 2376 216 cmd.exe 112 PID 216 wrote to memory of 2376 216 cmd.exe 112 PID 3888 wrote to memory of 5108 3888 cmd.exe 115 PID 3888 wrote to memory of 5108 3888 cmd.exe 115 PID 3888 wrote to memory of 5108 3888 cmd.exe 115 PID 1080 wrote to memory of 5068 1080 cmd.exe 113 PID 1080 wrote to memory of 5068 1080 cmd.exe 113 PID 1080 wrote to memory of 5068 1080 cmd.exe 113 PID 5024 wrote to memory of 4604 5024 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:3568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:5068
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:4796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:2204
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6481" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6481" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:4084
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4255" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4255" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"3⤵
- Creates scheduled task(s)
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9538" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵PID:680
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5228" /TR "C:\Users\Admin\AppData\Local\Temp\214534f7a6b7c4e1e9a1d3cfc04fb20ddb9bb526c7e95a88dd76690bf4b1a593.exe"2⤵PID:2256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 10402⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4596 -ip 45961⤵PID:556